Security is a shared responsibility at selectry. We appreciate responsible reports that help us protect our customers, candidates, team, and systems.

Please do not disclose a suspected vulnerability in a public issue, discussion, pull request, or social-media post.

For a public repository that offers Report a vulnerability on its Security tab, use that private reporting form. For private repositories and internal systems, contact the repository administrators through an established private company channel and include SECURITY in the subject or first line.

Include, where possible:

• the affected repository, service, or component;
• a clear description of the issue and its potential impact;
• reproducible steps or a minimal proof of concept;
• any suggested mitigation; and
• a safe way to contact you for follow-up.

Do not access, modify, retain, or share data that is not yours. Avoid privacy violations, service disruption, social engineering, denial-of-service testing, and automated scanning that could degrade our systems.

We will acknowledge a complete report as soon as reasonably possible, assess severity and scope, and coordinate remediation and disclosure. Please allow us a reasonable opportunity to investigate and fix the issue before publishing details.

Only actively maintained versions and deployed services are supported. Repository maintainers can clarify whether a specific version remains supported.